diff --git a/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h b/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
index fa3ee7f..435c62d 100644
--- a/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
+++ b/audio/core/all-versions/vts/functional/AudioPrimaryHidlHalTest.h
@@ -34,6 +34,7 @@
 
 #include <hwbinder/IPCThreadState.h>
 
+#include <android-base/expected.h>
 #include <android-base/logging.h>
 #include <system/audio_config.h>
 
@@ -130,6 +131,33 @@
     using IDevice = ::android::hardware::audio::CPP_VERSION::IDevice;
     using IDevicesFactory = ::android::hardware::audio::CPP_VERSION::IDevicesFactory;
 
+    static android::base::expected<std::vector<std::string>, std::string> getAllFactoryInstances() {
+        using ::android::hardware::audio::CPP_VERSION::IDevicesFactory;
+        const std::string factoryDescriptor = IDevicesFactory::descriptor;
+        // Make sure that the instance is the exact minor version.
+        // Using a 7.1 factory for 7.0 test is not always possible because
+        // 7.1 can be configured via the XML config to use features that are
+        // absent in 7.0.
+        auto instances = ::android::hardware::getAllHalInstanceNames(factoryDescriptor);
+        if (instances.empty()) return instances;
+        // Use the default instance for checking the implementation version.
+        auto defaultInstance = IDevicesFactory::getService("default");
+        if (defaultInstance == nullptr) {
+            return ::android::base::unexpected("Failed to obtain IDevicesFactory/default");
+        }
+        std::string actualDescriptor;
+        auto intDescRet = defaultInstance->interfaceDescriptor(
+                [&](const auto& descriptor) { actualDescriptor = descriptor; });
+        if (!intDescRet.isOk()) {
+            return ::android::base::unexpected("Failed to obtain interface descriptor: " +
+                                               intDescRet.description());
+        }
+        if (factoryDescriptor == actualDescriptor)
+            return instances;
+        else
+            return {};
+    }
+
     virtual ~HidlTest() = default;
     // public access to avoid annoyances when using this method in template classes
     // derived from test classes
@@ -174,9 +202,11 @@
 }
 
 TEST(CheckConfig, audioPolicyConfigurationValidation) {
-    const auto factories = ::android::hardware::getAllHalInstanceNames(
-            ::android::hardware::audio::CPP_VERSION::IDevicesFactory::descriptor);
-    if (factories.size() == 0) {
+    const auto factories = HidlTest::getAllFactoryInstances();
+    if (!factories.ok()) {
+        FAIL() << factories.error();
+    }
+    if (factories.value().size() == 0) {
         GTEST_SKIP() << "Skipping audioPolicyConfigurationValidation because no factory instances "
                         "are found.";
     }
@@ -205,11 +235,11 @@
 const std::vector<DeviceParameter>& getDeviceParameters() {
     static std::vector<DeviceParameter> parameters = [] {
         std::vector<DeviceParameter> result;
-        const auto factories = ::android::hardware::getAllHalInstanceNames(
-                ::android::hardware::audio::CPP_VERSION::IDevicesFactory::descriptor);
+        const auto factories = HidlTest::getAllFactoryInstances();
+        if (!factories.ok()) return result;
         const auto devices = getCachedPolicyConfig().getModulesWithDevicesNames();
         result.reserve(devices.size());
-        for (const auto& factoryName : factories) {
+        for (const auto& factoryName : factories.value()) {
             for (const auto& deviceName : devices) {
                 if (DeviceManager::getInstance().get(factoryName, deviceName) != nullptr) {
                     result.emplace_back(factoryName, deviceName);
@@ -224,9 +254,9 @@
 const std::vector<DeviceParameter>& getDeviceParametersForFactoryTests() {
     static std::vector<DeviceParameter> parameters = [] {
         std::vector<DeviceParameter> result;
-        const auto factories = ::android::hardware::getAllHalInstanceNames(
-                ::android::hardware::audio::CPP_VERSION::IDevicesFactory::descriptor);
-        for (const auto& factoryName : factories) {
+        const auto factories = HidlTest::getAllFactoryInstances();
+        if (!factories.ok()) return result;
+        for (const auto& factoryName : factories.value()) {
             result.emplace_back(factoryName,
                                 DeviceManager::getInstance().getPrimary(factoryName) != nullptr
                                         ? DeviceManager::kPrimaryDevice
diff --git a/automotive/sv/1.0/default/Android.bp b/automotive/sv/1.0/default/Android.bp
index da974a0..82e11a8 100644
--- a/automotive/sv/1.0/default/Android.bp
+++ b/automotive/sv/1.0/default/Android.bp
@@ -29,9 +29,7 @@
     relative_install_path: "hw",
     srcs: [
         "service.cpp",
-        "SurroundViewService.cpp",
-        "SurroundView2dSession.cpp",
-        "SurroundView3dSession.cpp",
+        ":automotiveSvV1.0_sources",
     ],
     init_rc: ["android.hardware.automotive.sv@1.0-service.rc"],
     vintf_fragments: ["android.hardware.automotive.sv@1.0-service.xml"],
@@ -54,3 +52,17 @@
         "-g",
     ],
 }
+
+filegroup {
+    name: "automotiveSvV1.0_sources",
+    srcs: [
+        "SurroundViewService.cpp",
+        "SurroundView2dSession.cpp",
+        "SurroundView3dSession.cpp",
+    ],
+}
+
+cc_library_headers {
+    name: "automotiveSvV1.0_headers",
+    export_include_dirs: ["."],
+}
diff --git a/automotive/sv/1.0/default/tests/fuzzer/Android.bp b/automotive/sv/1.0/default/tests/fuzzer/Android.bp
new file mode 100644
index 0000000..c037723
--- /dev/null
+++ b/automotive/sv/1.0/default/tests/fuzzer/Android.bp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+cc_fuzz {
+    name: "automotiveSvV1.0_fuzzer",
+    srcs: [
+        "AutomotiveSvV1_0Fuzzer.cpp",
+        "SurroundViewStream.cpp",
+        ":automotiveSvV1.0_sources",
+    ],
+    header_libs: [
+        "automotiveSvV1.0_headers",
+    ],
+    shared_libs: [
+        "android.hardware.automotive.sv@1.0",
+        "android.hidl.allocator@1.0",
+        "libhidlbase",
+        "libutils",
+        "libhidlmemory",
+        "liblog",
+    ],
+    fuzz_config: {
+        cc: [
+            "android-media-fuzzing-reports@google.com",
+        ],
+        componentid: 533764,
+    },
+}
diff --git a/automotive/sv/1.0/default/tests/fuzzer/AutomotiveSvV1_0Fuzzer.cpp b/automotive/sv/1.0/default/tests/fuzzer/AutomotiveSvV1_0Fuzzer.cpp
new file mode 100644
index 0000000..98834f5
--- /dev/null
+++ b/automotive/sv/1.0/default/tests/fuzzer/AutomotiveSvV1_0Fuzzer.cpp
@@ -0,0 +1,433 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+
+#include "AutomotiveSvV1_0Fuzzer.h"
+#include <SurroundViewStream.h>
+#include <android/hidl/allocator/1.0/IAllocator.h>
+#include <hidlmemory/mapping.h>
+
+namespace android::hardware::automotive::sv::V1_0::implementation::fuzzer {
+
+using ::android::hardware::hidl_memory;
+using ::android::hardware::hidl_string;
+using ::android::hardware::hidl_vec;
+using ::android::hidl::allocator::V1_0::IAllocator;
+
+constexpr uint32_t kMinConfigDimension = 0;
+constexpr uint32_t kMaxConfigDimension = 4096;
+constexpr uint32_t kVertexByteSize = (3 * sizeof(float)) + 4;
+constexpr uint32_t kIdByteSize = 2;
+constexpr size_t kMaxCharacters = 30;
+constexpr size_t kMaxVertices = 10;
+constexpr size_t kMaxCameraPoints = 10;
+constexpr size_t kMaxViews = 10;
+constexpr size_t kMaxOverlays = 10;
+constexpr size_t kMinSvBuffers = 0;
+constexpr size_t kMaxSvBuffers = 10;
+
+void SurroundViewFuzzer::invoke2dSessionAPI() {
+    sp<ISurroundView2dSession> surroundView2dSession;
+
+    while (mFuzzedDataProvider.remaining_bytes() > 0) {
+        auto surroundView2dFunc = mFuzzedDataProvider.PickValueInArray<
+                const std::function<void()>>({
+                [&]() {
+                    mSurroundViewService->start2dSession(
+                            [&surroundView2dSession](const sp<ISurroundView2dSession>& session,
+                                                     SvResult result) {
+                                if (result == SvResult::OK) {
+                                    surroundView2dSession = session;
+                                }
+                            });
+                },
+                [&]() {
+                    if (surroundView2dSession) {
+                        sp<SurroundViewStream> handler =
+                                sp<SurroundViewStream>::make(surroundView2dSession);
+                        surroundView2dSession->startStream(handler);
+                        mIs2dStreamStarted = true;
+                    }
+                },
+                [&]() {
+                    if (surroundView2dSession) {
+                        surroundView2dSession->get2dMappingInfo(
+                                []([[maybe_unused]] Sv2dMappingInfo info) {});
+                    }
+                },
+                [&]() {
+                    if (surroundView2dSession) {
+                        Sv2dConfig config;
+                        config.width = mFuzzedDataProvider.ConsumeIntegralInRange<uint32_t>(
+                                kMinConfigDimension, kMaxConfigDimension);
+                        if (mFuzzedDataProvider.ConsumeBool()) {
+                            config.blending = static_cast<SvQuality>(
+                                    mFuzzedDataProvider.ConsumeIntegral<uint32_t>());
+                        } else {
+                            config.blending = mFuzzedDataProvider.ConsumeBool() ? (SvQuality::HIGH)
+                                                                                : (SvQuality::LOW);
+                        }
+                        surroundView2dSession->set2dConfig(config);
+                    }
+                },
+                [&]() {
+                    if (surroundView2dSession) {
+                        surroundView2dSession->get2dConfig([&](Sv2dConfig) {});
+                    }
+                },
+                [&]() {
+                    if (surroundView2dSession) {
+                        hidl_vec<Point2dInt> points2dCamera;
+                        const size_t camPoints = mFuzzedDataProvider.ConsumeIntegralInRange<size_t>(
+                                1, kMaxCameraPoints);
+                        points2dCamera.resize(camPoints);
+                        for (size_t i = 0; i < camPoints; ++i) {
+                            points2dCamera[i].x = mFuzzedDataProvider.ConsumeFloatingPoint<float>();
+                            points2dCamera[i].y = mFuzzedDataProvider.ConsumeFloatingPoint<float>();
+                        }
+
+                        hidl_vec<hidl_string> cameraIds;
+                        mSurroundViewService->getCameraIds(
+                                [&cameraIds](const hidl_vec<hidl_string>& camIds) {
+                                    cameraIds = camIds;
+                                });
+                        hidl_string cameraId;
+                        if (cameraIds.size() > 0 && mFuzzedDataProvider.ConsumeBool()) {
+                            const size_t cameraIndex =
+                                    mFuzzedDataProvider.ConsumeIntegralInRange<size_t>(
+                                            0, cameraIds.size() - 1);
+                            cameraId = cameraIds[cameraIndex];
+                        } else {
+                            cameraId =
+                                    mFuzzedDataProvider.ConsumeRandomLengthString(kMaxCharacters);
+                        }
+                        surroundView2dSession->projectCameraPoints(
+                                points2dCamera, cameraId,
+                                []([[maybe_unused]] const hidl_vec<Point2dFloat>& outPoints) {});
+                    }
+                },
+                [&]() {
+                    if (surroundView2dSession) {
+                        SvFramesDesc frames;
+                        frames.timestampNs = mFuzzedDataProvider.ConsumeIntegral<uint64_t>();
+                        frames.sequenceId = mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                        size_t numSvBuffers = mFuzzedDataProvider.ConsumeIntegralInRange<size_t>(
+                                kMinSvBuffers, kMaxSvBuffers);
+                        frames.svBuffers.resize(numSvBuffers);
+                        for (int i = 0; i < numSvBuffers; ++i) {
+                            frames.svBuffers[i].viewId =
+                                    mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                            frames.svBuffers[i].hardwareBuffer.nativeHandle = new native_handle_t();
+                            frames.svBuffers[i].hardwareBuffer.description[0] =
+                                    mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                            frames.svBuffers[i].hardwareBuffer.description[1] =
+                                    mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                        }
+                        surroundView2dSession->doneWithFrames(frames);
+                        for (int i = 0; i < numSvBuffers; ++i) {
+                            delete frames.svBuffers[i].hardwareBuffer.nativeHandle;
+                        }
+                    }
+                },
+                [&]() {
+                    if (surroundView2dSession) {
+                        surroundView2dSession->stopStream();
+                        mIs2dStreamStarted = false;
+                    }
+                },
+                [&]() {
+                    mSurroundViewService->stop2dSession(
+                            mFuzzedDataProvider.ConsumeBool() ? surroundView2dSession : nullptr);
+                },
+        });
+        surroundView2dFunc();
+    }
+
+    if (surroundView2dSession && mIs2dStreamStarted) {
+        surroundView2dSession->stopStream();
+    }
+}
+
+void SurroundViewFuzzer::invoke3dSessionAPI() {
+    sp<ISurroundView3dSession> surroundView3dSession;
+    while (mFuzzedDataProvider.remaining_bytes() > 0) {
+        auto surroundView3dFunc = mFuzzedDataProvider.PickValueInArray<
+                const std::function<void()>>({
+                [&]() {
+                    mSurroundViewService->start3dSession(
+                            [&surroundView3dSession](const sp<ISurroundView3dSession>& session,
+                                                     SvResult result) {
+                                if (result == SvResult::OK) {
+                                    surroundView3dSession = session;
+                                }
+                            });
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        sp<SurroundViewStream> handler =
+                                sp<SurroundViewStream>::make(surroundView3dSession);
+                        surroundView3dSession->startStream(handler);
+                        mIs3dStreamStarted = true;
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        const size_t numViews =
+                                mFuzzedDataProvider.ConsumeIntegralInRange<size_t>(1, kMaxViews);
+                        std::vector<View3d> views(numViews);
+                        for (size_t i = 0; i < numViews; ++i) {
+                            views[i].viewId = mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                        }
+                        surroundView3dSession->setViews(views);
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        Sv3dConfig config;
+                        config.width = mFuzzedDataProvider.ConsumeIntegralInRange<uint32_t>(
+                                kMinConfigDimension, kMaxConfigDimension);
+                        config.height = mFuzzedDataProvider.ConsumeIntegralInRange<uint32_t>(
+                                kMinConfigDimension, kMaxConfigDimension);
+                        if (mFuzzedDataProvider.ConsumeBool()) {
+                            config.carDetails = static_cast<SvQuality>(
+                                    mFuzzedDataProvider.ConsumeIntegral<uint32_t>());
+                        } else {
+                            config.carDetails = mFuzzedDataProvider.ConsumeBool()
+                                                        ? (SvQuality::HIGH)
+                                                        : (SvQuality::LOW);
+                        }
+                        surroundView3dSession->set3dConfig(config);
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        surroundView3dSession->get3dConfig([&](Sv3dConfig) {});
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        Point2dInt cameraPoint;
+                        cameraPoint.x = mFuzzedDataProvider.ConsumeFloatingPoint<float>();
+                        cameraPoint.y = mFuzzedDataProvider.ConsumeFloatingPoint<float>();
+                        std::vector<Point2dInt> cameraPoints = {cameraPoint};
+                        hidl_vec<hidl_string> cameraIds;
+                        mSurroundViewService->getCameraIds(
+                                [&cameraIds](const hidl_vec<hidl_string>& camIds) {
+                                    cameraIds = camIds;
+                                });
+                        hidl_string cameraId;
+                        if (cameraIds.size() > 0 && mFuzzedDataProvider.ConsumeBool()) {
+                            const size_t cameraIndex =
+                                    mFuzzedDataProvider.ConsumeIntegralInRange<size_t>(
+                                            0, cameraIds.size() - 1);
+                            cameraId = cameraIds[cameraIndex];
+                        } else {
+                            cameraId =
+                                    mFuzzedDataProvider.ConsumeRandomLengthString(kMaxCharacters);
+                        }
+                        std::vector<Point3dFloat> points3d;
+                        surroundView3dSession->projectCameraPointsTo3dSurface(
+                                cameraPoints, cameraId,
+                                [&points3d]([[maybe_unused]] const hidl_vec<Point3dFloat>&
+                                                    points3dproj) { points3d = points3dproj; });
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        // success case
+                        surroundView3dSession->updateOverlays(mOverlaysdata);
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        initSampleOverlaysData();
+                        // Fail with ID mismatch
+                        // Set id of second overlay in shared memory to 2 (expected is 1).
+                        auto& overlaysDescVector = mOverlaysdata.overlaysMemoryDesc;
+                        auto& pIMemory = mMemory;
+                        int32_t indexPosition = mFuzzedDataProvider.ConsumeIntegralInRange<int32_t>(
+                                0, mNumOverlays - 1);
+                        int32_t mismatchedValueIndex =
+                                mFuzzedDataProvider.ConsumeIntegralInRange<int32_t>(
+                                        0, mNumOverlays - 1);
+                        setIndexOfOverlaysMemory(overlaysDescVector, pIMemory, indexPosition,
+                                                 overlaysDescVector[mismatchedValueIndex].id);
+                        surroundView3dSession->updateOverlays(mOverlaysdata);
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        // Fail with NULL memory
+                        // Set shared memory to null.
+                        mOverlaysdata.overlaysMemory = hidl_memory();
+                        surroundView3dSession->updateOverlays(mOverlaysdata);
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        SvFramesDesc frames;
+                        frames.timestampNs = mFuzzedDataProvider.ConsumeIntegral<uint64_t>();
+                        frames.sequenceId = mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                        size_t numSvBuffers = mFuzzedDataProvider.ConsumeIntegralInRange<size_t>(
+                                kMinSvBuffers, kMaxSvBuffers);
+                        frames.svBuffers.resize(numSvBuffers);
+                        for (int i = 0; i < numSvBuffers; ++i) {
+                            frames.svBuffers[i].viewId =
+                                    mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                            frames.svBuffers[i].hardwareBuffer.nativeHandle = new native_handle_t();
+                            frames.svBuffers[i].hardwareBuffer.description[0] =
+                                    mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                            frames.svBuffers[i].hardwareBuffer.description[1] =
+                                    mFuzzedDataProvider.ConsumeIntegral<uint32_t>();
+                        }
+                        surroundView3dSession->doneWithFrames(frames);
+                        for (int i = 0; i < numSvBuffers; ++i) {
+                            delete frames.svBuffers[i].hardwareBuffer.nativeHandle;
+                        }
+                    }
+                },
+                [&]() {
+                    if (surroundView3dSession) {
+                        surroundView3dSession->stopStream();
+                        mIs3dStreamStarted = false;
+                    }
+                },
+                [&]() {
+                    mSurroundViewService->stop3dSession(
+                            mFuzzedDataProvider.ConsumeBool() ? surroundView3dSession : nullptr);
+                },
+        });
+        surroundView3dFunc();
+    }
+    if (surroundView3dSession && mIs3dStreamStarted) {
+        surroundView3dSession->stopStream();
+    }
+}
+
+void SurroundViewFuzzer::process() {
+    mFuzzedDataProvider.ConsumeBool() ? invoke2dSessionAPI() : invoke3dSessionAPI();
+}
+
+std::pair<hidl_memory, sp<IMemory>> SurroundViewFuzzer::getMappedSharedMemory(int32_t bytesSize) {
+    const auto nullResult = std::make_pair(hidl_memory(), nullptr);
+
+    sp<IAllocator> ashmemAllocator = IAllocator::getService("ashmem");
+    if (ashmemAllocator.get() == nullptr) {
+        return nullResult;
+    }
+
+    // Allocate shared memory.
+    hidl_memory hidlMemory;
+    bool allocateSuccess = false;
+    Return<void> result =
+            ashmemAllocator->allocate(bytesSize, [&](bool success, const hidl_memory& hidlMem) {
+                if (!success) {
+                    return;
+                }
+                allocateSuccess = success;
+                hidlMemory = hidlMem;
+            });
+
+    // Check result of allocated memory.
+    if (!result.isOk() || !allocateSuccess) {
+        return nullResult;
+    }
+
+    // Map shared memory.
+    sp<IMemory> pIMemory = mapMemory(hidlMemory);
+    if (pIMemory.get() == nullptr) {
+        return nullResult;
+    }
+
+    return std::make_pair(hidlMemory, pIMemory);
+}
+
+void SurroundViewFuzzer::setIndexOfOverlaysMemory(
+        const std::vector<OverlayMemoryDesc>& overlaysMemDesc, sp<IMemory> pIMemory,
+        int32_t indexPosition, uint16_t indexValue) {
+    // Count the number of vertices until the index.
+    int32_t totalVerticesCount = 0;
+    for (int32_t i = 0; i < indexPosition; ++i) {
+        totalVerticesCount += overlaysMemDesc[i].verticesCount;
+    }
+
+    const int32_t indexBytePosition =
+            (indexPosition * kIdByteSize) + (kVertexByteSize * totalVerticesCount);
+
+    uint8_t* pSharedMemoryData = (uint8_t*)((void*)pIMemory->getPointer());
+    pSharedMemoryData += indexBytePosition;
+    uint16_t* pIndex16bit = (uint16_t*)pSharedMemoryData;
+
+    // Modify shared memory.
+    pIMemory->update();
+    *pIndex16bit = indexValue;
+    pIMemory->commit();
+}
+
+void SurroundViewFuzzer::initSampleOverlaysData() {
+    const size_t mNumOverlays =
+            mFuzzedDataProvider.ConsumeIntegralInRange<size_t>(kMinOverlays, kMaxOverlays);
+    mOverlaysdata.overlaysMemoryDesc.resize(mNumOverlays);
+
+    int32_t sharedMemBytesSize = 0;
+    std::vector<OverlayMemoryDesc> overlaysDescVector = {};
+    OverlayMemoryDesc overlayMemDesc[mNumOverlays];
+    for (size_t i = 0; i < mNumOverlays; ++i) {
+        overlayMemDesc[i].id = i;
+        overlayMemDesc[i].verticesCount =
+                mFuzzedDataProvider.ConsumeIntegralInRange<size_t>(1, kMaxVertices);
+        overlayMemDesc[i].overlayPrimitive = mFuzzedDataProvider.ConsumeBool()
+                                                     ? (OverlayPrimitive::TRIANGLES)
+                                                     : (OverlayPrimitive::TRIANGLES_STRIP);
+        mOverlaysdata.overlaysMemoryDesc[i] = overlayMemDesc[i];
+
+        sharedMemBytesSize += kIdByteSize + kVertexByteSize * overlayMemDesc[i].verticesCount;
+        overlaysDescVector.push_back(overlayMemDesc[i]);
+    }
+
+    std::pair<hidl_memory, sp<IMemory>> sharedMem = getMappedSharedMemory(sharedMemBytesSize);
+    sp<IMemory> pIMemory = std::get<1>(sharedMem);
+    if (pIMemory.get() == nullptr) {
+        mOverlaysdata = OverlaysData();
+        mMemory = nullptr;
+        return;
+    }
+
+    // Get pointer to shared memory data and set all bytes to 0.
+    uint8_t* pSharedMemoryData = (uint8_t*)((void*)pIMemory->getPointer());
+    pIMemory->update();
+    memset(pSharedMemoryData, 0, sharedMemBytesSize);
+    pIMemory->commit();
+
+    // Set indexes in shared memory.
+    for (size_t i = 0; i < mNumOverlays; ++i) {
+        setIndexOfOverlaysMemory(overlaysDescVector, pIMemory, i, overlayMemDesc[i].id);
+    }
+
+    mOverlaysdata.overlaysMemoryDesc = overlaysDescVector;
+    mOverlaysdata.overlaysMemory = std::get<0>(sharedMem);
+    mMemory = pIMemory;
+}
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+    if (size < 1) {
+        return 0;
+    }
+    SurroundViewFuzzer surroundViewFuzzer(data, size);
+    surroundViewFuzzer.process();
+    return 0;
+}
+}  // namespace android::hardware::automotive::sv::V1_0::implementation::fuzzer
diff --git a/automotive/sv/1.0/default/tests/fuzzer/AutomotiveSvV1_0Fuzzer.h b/automotive/sv/1.0/default/tests/fuzzer/AutomotiveSvV1_0Fuzzer.h
new file mode 100644
index 0000000..23e5a31
--- /dev/null
+++ b/automotive/sv/1.0/default/tests/fuzzer/AutomotiveSvV1_0Fuzzer.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at:
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ */
+#pragma once
+#include <SurroundViewService.h>
+#include <android/hidl/memory/1.0/IMemory.h>
+#include <fuzzer/FuzzedDataProvider.h>
+
+namespace android::hardware::automotive::sv::V1_0::implementation::fuzzer {
+
+using ::android::sp;
+using ::android::hidl::memory::V1_0::IMemory;
+
+constexpr size_t kMinOverlays = 2;
+
+class SurroundViewFuzzer {
+  public:
+    SurroundViewFuzzer(const uint8_t* data, size_t size) : mFuzzedDataProvider(data, size) {
+        mSurroundViewService = sp<SurroundViewService>::make();
+    }
+    ~SurroundViewFuzzer() = default;
+    void process();
+
+  private:
+    void invoke2dSessionAPI();
+    void invoke3dSessionAPI();
+    std::pair<hidl_memory, sp<IMemory>> getMappedSharedMemory(int32_t bytesSize);
+    void initSampleOverlaysData();
+    void setIndexOfOverlaysMemory(const std::vector<OverlayMemoryDesc>& overlaysMemDesc,
+                                  sp<IMemory> pIMemory, int32_t indexPosition, uint16_t indexValue);
+    OverlaysData mOverlaysdata = {};
+    size_t mNumOverlays = kMinOverlays;
+    sp<IMemory> mMemory = nullptr;
+    FuzzedDataProvider mFuzzedDataProvider;
+    sp<SurroundViewService> mSurroundViewService = nullptr;
+    bool mIs2dStreamStarted = false;
+    bool mIs3dStreamStarted = false;
+};
+}  // namespace android::hardware::automotive::sv::V1_0::implementation::fuzzer
diff --git a/automotive/sv/1.0/default/tests/fuzzer/SurroundViewStream.cpp b/automotive/sv/1.0/default/tests/fuzzer/SurroundViewStream.cpp
new file mode 100644
index 0000000..b81a08c
--- /dev/null
+++ b/automotive/sv/1.0/default/tests/fuzzer/SurroundViewStream.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include "SurroundViewStream.h"
+
+namespace android::hardware::automotive::sv::V1_0::implementation::fuzzer {
+
+using std::lock_guard;
+
+SurroundViewStream::SurroundViewStream(sp<ISurroundViewSession> pSession)
+    : mSession(pSession), mReceiveFramesCount(0) {}
+
+Return<void> SurroundViewStream::notify(SvEvent svEvent) {
+    lock_guard<mutex> lock(mLock);
+    switch (svEvent) {
+        case SvEvent::STREAM_STARTED:
+        case SvEvent::CONFIG_UPDATED:
+        case SvEvent::STREAM_STOPPED:
+        case SvEvent::FRAME_DROPPED:
+        case SvEvent::TIMEOUT:
+            mReceivedEvents.emplace_back(svEvent);
+            break;
+        default:
+            break;
+    }
+
+    return android::hardware::Void();
+}
+
+Return<void> SurroundViewStream::receiveFrames(const SvFramesDesc& svFramesDesc) {
+    lock_guard<mutex> lock(mLock);
+    if ((mLastReceivedFrames.timestampNs >= svFramesDesc.timestampNs ||
+         mLastReceivedFrames.sequenceId >= svFramesDesc.sequenceId) &&
+        mReceiveFramesCount != 0) {
+        // The incoming frames are with invalid timestamp or sequenceId
+        mAllFramesValid = false;
+    }
+
+    for (int i = 0; i < svFramesDesc.svBuffers.size(); ++i) {
+        if (svFramesDesc.svBuffers[i].hardwareBuffer.nativeHandle == nullptr) {
+            mAllFramesValid = false;
+            // The incoming frames are with invalid nativeHandle
+            break;
+        }
+    }
+
+    ++mReceiveFramesCount;
+
+    // Store all the information except for the handle
+    mLastReceivedFrames.timestampNs = svFramesDesc.timestampNs;
+    mLastReceivedFrames.sequenceId = svFramesDesc.sequenceId;
+    mLastReceivedFrames.svBuffers.resize(svFramesDesc.svBuffers.size());
+    for (int i = 0; i < svFramesDesc.svBuffers.size(); ++i) {
+        mLastReceivedFrames.svBuffers[i].viewId = svFramesDesc.svBuffers[i].viewId;
+        mLastReceivedFrames.svBuffers[i].hardwareBuffer.description =
+                svFramesDesc.svBuffers[i].hardwareBuffer.description;
+    }
+
+    return android::hardware::Void();
+}
+}  // namespace android::hardware::automotive::sv::V1_0::implementation::fuzzer
diff --git a/automotive/sv/1.0/default/tests/fuzzer/SurroundViewStream.h b/automotive/sv/1.0/default/tests/fuzzer/SurroundViewStream.h
new file mode 100644
index 0000000..8135bc1
--- /dev/null
+++ b/automotive/sv/1.0/default/tests/fuzzer/SurroundViewStream.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2022 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#pragma once
+
+#include <android/hardware/automotive/sv/1.0/ISurroundViewSession.h>
+#include <android/hardware/automotive/sv/1.0/ISurroundViewStream.h>
+#include <android/hardware/automotive/sv/1.0/types.h>
+
+#include <thread>
+#include <vector>
+
+namespace android::hardware::automotive::sv::V1_0::implementation::fuzzer {
+
+using android::sp;
+using android::hardware::Return;
+using std::mutex;
+using std::vector;
+
+class SurroundViewStream : public ISurroundViewStream {
+  public:
+    SurroundViewStream(sp<ISurroundViewSession> session);
+
+    Return<void> notify(SvEvent svEvent) override;
+    Return<void> receiveFrames(const SvFramesDesc& svFramesDesc) override;
+
+    bool checkEventReceived(SvEvent svEvent);
+    SvFramesDesc getLastReceivedFrames();
+    int getReceiveFramesCount();
+    bool areAllFramesValid();
+    void setDoNotReturnFrames(bool flag);
+
+  private:
+    mutex mLock;
+
+    vector<SvEvent> mReceivedEvents;
+    sp<ISurroundViewSession> mSession;
+    SvFramesDesc mLastReceivedFrames;
+    int mReceiveFramesCount;
+    bool mAllFramesValid = true;
+};
+}  // namespace android::hardware::automotive::sv::V1_0::implementation::fuzzer
diff --git a/bluetooth/1.0/default/test/fuzzer/Android.bp b/bluetooth/1.0/default/test/fuzzer/Android.bp
index 81f328e..691136f 100644
--- a/bluetooth/1.0/default/test/fuzzer/Android.bp
+++ b/bluetooth/1.0/default/test/fuzzer/Android.bp
@@ -46,7 +46,6 @@
         "android.hardware.bluetooth-async",
         "android.hardware.bluetooth-hci",
         "libcutils",
-        "libutils",
     ],
     shared_libs: [
         "android.hardware.bluetooth@1.0",
@@ -54,6 +53,7 @@
         "libhidlbase",
         "libbt-vendor-fuzz",
         "liblog",
+        "libutils",
     ],
     fuzz_config: {
         cc: [
diff --git a/health/aidl/OWNERS b/health/aidl/OWNERS
index cd06415..fcad499 100644
--- a/health/aidl/OWNERS
+++ b/health/aidl/OWNERS
@@ -1,2 +1,4 @@
 # Bug component: 30545
 elsk@google.com
+smoreland@google.com
+stayfan@google.com
diff --git a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
index 14c756d..dd6b0f7 100644
--- a/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
+++ b/keymaster/4.0/vts/functional/keymaster_hidl_hal_test.cpp
@@ -2866,8 +2866,8 @@
 
         EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::DECRYPT, params));
         string plaintext;
-        ErrorCode error = Finish(message, &plaintext);
-        if (error == ErrorCode::INVALID_INPUT_LENGTH) {
+        ErrorCode error = Finish(ciphertext, &plaintext);
+        if (error == ErrorCode::INVALID_ARGUMENT) {
             // This is the expected error, we can exit the test now.
             return;
         } else {
diff --git a/radio/aidl/vts/radio_config_test.cpp b/radio/aidl/vts/radio_config_test.cpp
index 5e1c811..258b172 100644
--- a/radio/aidl/vts/radio_config_test.cpp
+++ b/radio/aidl/vts/radio_config_test.cpp
@@ -59,6 +59,7 @@
     serial = GetRandomSerialNumber();
     ndk::ScopedAStatus res = radio_config->getHalDeviceCapabilities(serial);
     ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
     ALOGI("getHalDeviceCapabilities, rspInfo.error = %s\n",
           toString(radioRsp_config->rspInfo.error).c_str());
 }
@@ -70,6 +71,7 @@
     serial = GetRandomSerialNumber();
     ndk::ScopedAStatus res = radio_config->getSimSlotsStatus(serial);
     ASSERT_OK(res);
+    EXPECT_EQ(std::cv_status::no_timeout, wait());
     ALOGI("getSimSlotsStatus, rspInfo.error = %s\n",
           toString(radioRsp_config->rspInfo.error).c_str());
 }
@@ -166,31 +168,60 @@
  * Test IRadioConfig.setSimSlotsMapping() for the response returned.
  */
 TEST_P(RadioConfigTest, setSimSlotsMapping) {
-    serial = GetRandomSerialNumber();
-    SlotPortMapping slotPortMapping;
-    slotPortMapping.physicalSlotId = 0;
-    slotPortMapping.portId = 0;
-    std::vector<SlotPortMapping> slotPortMappingList = {slotPortMapping};
-    if (isDsDsEnabled()) {
-        slotPortMapping.physicalSlotId = 1;
-        slotPortMappingList.push_back(slotPortMapping);
-    } else if (isTsTsEnabled()) {
-        slotPortMapping.physicalSlotId = 1;
-        slotPortMappingList.push_back(slotPortMapping);
-        slotPortMapping.physicalSlotId = 2;
-        slotPortMappingList.push_back(slotPortMapping);
-    }
-    ndk::ScopedAStatus res = radio_config->setSimSlotsMapping(serial, slotPortMappingList);
-    ASSERT_OK(res);
-    EXPECT_EQ(std::cv_status::no_timeout, wait());
-    EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_config->rspInfo.type);
-    EXPECT_EQ(serial, radioRsp_config->rspInfo.serial);
-    ALOGI("setSimSlotsMapping, rspInfo.error = %s\n",
-          toString(radioRsp_config->rspInfo.error).c_str());
-    ASSERT_TRUE(CheckAnyOfErrors(radioRsp_config->rspInfo.error, {RadioError::NONE}));
+    // get slot status and set SIM slots mapping based on the result.
+    updateSimSlotStatus();
+    if (radioRsp_config->rspInfo.error == RadioError::NONE) {
+        SlotPortMapping slotPortMapping;
+        // put invalid value at first and adjust by slotStatusResponse.
+        slotPortMapping.physicalSlotId = -1;
+        slotPortMapping.portId = -1;
+        std::vector<SlotPortMapping> slotPortMappingList = {slotPortMapping};
+        if (isDsDsEnabled()) {
+            slotPortMappingList.push_back(slotPortMapping);
+        } else if (isTsTsEnabled()) {
+            slotPortMappingList.push_back(slotPortMapping);
+            slotPortMappingList.push_back(slotPortMapping);
+        }
+        for (size_t i = 0; i < radioRsp_config->simSlotStatus.size(); i++) {
+            ASSERT_TRUE(radioRsp_config->simSlotStatus[i].portInfo.size() > 0);
+            for (size_t j = 0; j < radioRsp_config->simSlotStatus[i].portInfo.size(); j++) {
+                if (radioRsp_config->simSlotStatus[i].portInfo[j].portActive) {
+                    int32_t logicalSlotId =
+                            radioRsp_config->simSlotStatus[i].portInfo[j].logicalSlotId;
+                    // logicalSlotId should be 0 or positive numbers if the port
+                    // is active.
+                    EXPECT_GE(logicalSlotId, 0);
+                    // logicalSlotId should be less than the maximum number of
+                    // supported SIM slots.
+                    EXPECT_LT(logicalSlotId, slotPortMappingList.size());
+                    if (logicalSlotId >= 0 && logicalSlotId < slotPortMappingList.size()) {
+                        slotPortMappingList[logicalSlotId].physicalSlotId = i;
+                        slotPortMappingList[logicalSlotId].portId = j;
+                    }
+                }
+            }
+        }
 
-    // Give some time for modem to fully switch SIM configuration
-    sleep(MODEM_SET_SIM_SLOT_MAPPING_DELAY_IN_SECONDS);
+        // set SIM slots mapping
+        for (size_t i = 0; i < slotPortMappingList.size(); i++) {
+            // physicalSlotId and portId should be 0 or positive numbers for the
+            // input of setSimSlotsMapping.
+            EXPECT_GE(slotPortMappingList[i].physicalSlotId, 0);
+            EXPECT_GE(slotPortMappingList[i].portId, 0);
+        }
+        serial = GetRandomSerialNumber();
+        ndk::ScopedAStatus res = radio_config->setSimSlotsMapping(serial, slotPortMappingList);
+        ASSERT_OK(res);
+        EXPECT_EQ(std::cv_status::no_timeout, wait());
+        EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_config->rspInfo.type);
+        EXPECT_EQ(serial, radioRsp_config->rspInfo.serial);
+        ALOGI("setSimSlotsMapping, rspInfo.error = %s\n",
+              toString(radioRsp_config->rspInfo.error).c_str());
+        ASSERT_TRUE(CheckAnyOfErrors(radioRsp_config->rspInfo.error, {RadioError::NONE}));
+
+        // Give some time for modem to fully switch SIM configuration
+        sleep(MODEM_SET_SIM_SLOT_MAPPING_DELAY_IN_SECONDS);
+    }
 }
 
 /*
@@ -207,12 +238,24 @@
     EXPECT_EQ(RadioResponseType::SOLICITED, radioRsp_config->rspInfo.type);
     EXPECT_EQ(serial, radioRsp_config->rspInfo.serial);
     if (radioRsp_config->rspInfo.error == RadioError::NONE) {
+        uint8_t simCount = 0;
         // check if cardState is present, portInfo size should be more than 0
         for (const SimSlotStatus& slotStatusResponse : radioRsp_config->simSlotStatus) {
             if (slotStatusResponse.cardState == CardStatus::STATE_PRESENT) {
                 ASSERT_TRUE(slotStatusResponse.portInfo.size() > 0);
-                ASSERT_TRUE(slotStatusResponse.portInfo[0].portActive);
+                for (const SimPortInfo& simPortInfo : slotStatusResponse.portInfo) {
+                    if (simPortInfo.portActive) {
+                        simCount++;
+                    }
+                }
             }
         }
+        if (isSsSsEnabled()) {
+            EXPECT_EQ(1, simCount);
+        } else if (isDsDsEnabled()) {
+            EXPECT_EQ(2, simCount);
+        } else if (isTsTsEnabled()) {
+            EXPECT_EQ(3, simCount);
+        }
     }
 }
diff --git a/radio/aidl/vts/radio_modem_response.cpp b/radio/aidl/vts/radio_modem_response.cpp
index d2715a8..20b44c5 100644
--- a/radio/aidl/vts/radio_modem_response.cpp
+++ b/radio/aidl/vts/radio_modem_response.cpp
@@ -24,6 +24,7 @@
 
 ndk::ScopedAStatus RadioModemResponse::enableModemResponse(const RadioResponseInfo& info) {
     rspInfo = info;
+    enableModemResponseToggle = !enableModemResponseToggle;
     parent_modem.notify(info.serial);
     return ndk::ScopedAStatus::ok();
 }
diff --git a/radio/aidl/vts/radio_modem_utils.h b/radio/aidl/vts/radio_modem_utils.h
index 8779e0c..49e1891 100644
--- a/radio/aidl/vts/radio_modem_utils.h
+++ b/radio/aidl/vts/radio_modem_utils.h
@@ -37,7 +37,7 @@
 
     RadioResponseInfo rspInfo;
     bool isModemEnabled;
-    bool enableModemResponseToggle;
+    bool enableModemResponseToggle = false;
 
     virtual ndk::ScopedAStatus acknowledgeRequest(int32_t serial) override;
 
diff --git a/security/keymint/aidl/android/hardware/security/keymint/IKeyMintOperation.aidl b/security/keymint/aidl/android/hardware/security/keymint/IKeyMintOperation.aidl
index ca89555..c30c183 100644
--- a/security/keymint/aidl/android/hardware/security/keymint/IKeyMintOperation.aidl
+++ b/security/keymint/aidl/android/hardware/security/keymint/IKeyMintOperation.aidl
@@ -242,7 +242,8 @@
      *   not a multiple of the AES block size, finish() must return
      *   ErrorCode::INVALID_INPUT_LENGTH.  If padding is PaddingMode::PKCS7, pad the data per the
      *   PKCS#7 specification, including adding an additional padding block if the data is a
-     *   multiple of the block length.
+     *   multiple of the block length.  If padding is PaddingMode::PKCS7 and decryption does not
+     *   result in valid padding, return ErrorCode::INVALID_ARGUMENT.
      *
      * o BlockMode::GCM.  During encryption, after processing all plaintext, compute the tag
      *   (Tag::MAC_LENGTH bytes) and append it to the returned ciphertext.  During decryption,
diff --git a/security/keymint/aidl/vts/functional/KeyMintTest.cpp b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
index 3b75c50..384c135 100644
--- a/security/keymint/aidl/vts/functional/KeyMintTest.cpp
+++ b/security/keymint/aidl/vts/functional/KeyMintTest.cpp
@@ -5481,18 +5481,45 @@
 
         EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::DECRYPT, params));
         string plaintext;
-        ErrorCode error = Finish(message, &plaintext);
-        if (error == ErrorCode::INVALID_INPUT_LENGTH) {
+        ErrorCode error = Finish(ciphertext, &plaintext);
+        if (error == ErrorCode::INVALID_ARGUMENT) {
             // This is the expected error, we can exit the test now.
             return;
         } else {
             // Very small chance we got valid decryption, so try again.
-            ASSERT_EQ(error, ErrorCode::OK);
+            ASSERT_EQ(error, ErrorCode::OK)
+                    << "Expected INVALID_ARGUMENT or (rarely) OK, got " << error;
         }
     }
     FAIL() << "Corrupt ciphertext should have failed to decrypt by now.";
 }
 
+/*
+ * EncryptionOperationsTest.AesEcbPkcs7CiphertextTooShort
+ *
+ * Verifies that AES decryption fails in the correct way when the padding is corrupted.
+ */
+TEST_P(EncryptionOperationsTest, AesEcbPkcs7CiphertextTooShort) {
+    ASSERT_EQ(ErrorCode::OK, GenerateKey(AuthorizationSetBuilder()
+                                                 .Authorization(TAG_NO_AUTH_REQUIRED)
+                                                 .AesEncryptionKey(128)
+                                                 .Authorization(TAG_BLOCK_MODE, BlockMode::ECB)
+                                                 .Padding(PaddingMode::PKCS7)));
+
+    auto params = AuthorizationSetBuilder().BlockMode(BlockMode::ECB).Padding(PaddingMode::PKCS7);
+
+    string message = "a";
+    string ciphertext = EncryptMessage(message, params);
+    EXPECT_EQ(16U, ciphertext.size());
+    EXPECT_NE(ciphertext, message);
+
+    // Shorten the ciphertext.
+    ciphertext.resize(ciphertext.size() - 1);
+    EXPECT_EQ(ErrorCode::OK, Begin(KeyPurpose::DECRYPT, params));
+    string plaintext;
+    EXPECT_EQ(ErrorCode::INVALID_INPUT_LENGTH, Finish(ciphertext, &plaintext));
+}
+
 vector<uint8_t> CopyIv(const AuthorizationSet& set) {
     auto iv = set.GetTagValue(TAG_NONCE);
     EXPECT_TRUE(iv);
diff --git a/vibrator/aidl/default/Android.bp b/vibrator/aidl/default/Android.bp
index acdbdcd..c4140be 100644
--- a/vibrator/aidl/default/Android.bp
+++ b/vibrator/aidl/default/Android.bp
@@ -63,7 +63,6 @@
         "libbinder_random_parcel",
         "libcutils",
         "liblog",
-        "libutils",
         "libvibratorexampleimpl",
     ],
     target: {
@@ -71,12 +70,14 @@
             shared_libs: [
                 "libbinder_ndk",
                 "libbinder",
+                "libutils",
             ],
         },
         host: {
             static_libs: [
                 "libbinder_ndk",
                 "libbinder",
+                "libutils",
             ],
         },
         darwin: {